WSO2 Open Banking Km vulnerabilities

9 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Exploited WSO2 Open Banking Km vulnerabilities

CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

CVE-2025-15039 — Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
CVE-2025-9312 — Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (CVSS 9.8)
CVE-2025-9804 — Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs (CVSS 6.5)
CVE-2025-10611 — Potential Broken Access Control in Multiple WSO2 Products via System REST APIs (CVSS 9.8)
CVE-2024-7073 — Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services (CVSS 6.5)
CVE-2024-7097 — Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup (CVSS 4.3)
CVE-2024-7096 — Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw (CVSS 5.4)
CVE-2024-6914 — Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover (CVSS 9.8)
CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability (CVSS 9.8) — exploited